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REMARKS 

The present application was filed on July 27, 1999 with claims 1-20. In the outstanding 
Office Action dated September 13, 2002, the Examiner: (i) rejected claims 1,3-12 and 14-20 under 
35 U.S.C. §103(a) as being unpatentable over U.S. Patent No. 6,118,936 to Lauer (hereinafter 
"Lauer") in view of Applicants' specification at page 2, lines 18, 19, 26 and 27 (hereinafter "alleged 
APA"); and (ii) rejected claims 2 and 13 under 35 U.S.C. §103(a) as being unpatentable over Lauer 
in view of APA, and further in view of David A. Rabenhorst, "Interactive Exploration of 
Multidimensional Data," Proceedings of the SPIE Symposium on Electronic Imaging, February 1 994 
(hereinafter "Rabenhorst"). 

In this response, Applicants: (i) amend independent claims 1, 9, 12 and 20; and (ii) traverse 
the § 1 03(a) rejections to claims 1 -20. Applicants respectfully request reconsideration of the present 
application in view of the following remarks. 

Regarding independent claims 1, 9, 12 and 20, Applicants respectfully assert that the 
combination of Lauer and the alleged APA fails to establish a prima facie case of obviousness under 
35 U.S.C. §103(a), as specified in M.P.E.P. §2143. 

As set forth therein, M.P.E.P. §2143 states that three requirements must be met to establish 
a prima facie case of obviousness. First, there must be some suggestion or motivation to combine 
reference teachings. Second, there must be a reasonable expectation of success. Third, the cited 
combination must teach or suggest all the claim limitations. While it is sufficient to show that a 
prima facie case of obviousness has not been established by showing that one of the requirements 
has not been met, Applicants respectfully believe that none of the requirements have been met. 

The present invention, for example as recited in amended independent claim 1, defines a 
processor-based method for use in analyzing non-fully structured data which is associated with one 
or more events, comprising the following steps. At least a portion of the non-fully structured data 
is parsed according to one or more parsing rules to convert the at least a portion of non-fully 
structured data to structured data. Presentation operations are provided which are respectively able 
to provide a presentation of at least a portion of the non-fully structured data, format at least a 
portion of the structured data to provide a presentation of a graphical representation of the at least 
a portion of structured data, and format at least a portion of the structured data to provide a 
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presentation of a summary representation of the at least a portion of structured data. Data associated 
with two or more of the presentations is coordinated, when desired, to enable a coordinated analysis 
of the data. Independent claim 9 defines a system-based invention having similar limitations, while 
independent claim 12 and independent claim 20 respectively define an apparatus-based invention 
and an article of manufacture-based invention having similar limitations. 

Applicants amended independent claims 1,9, 12 and 20 in an effort to further clarify the 
subject matter of the claimed invention. Support for the amendments may be found throughout the 
specification, for example, see page 6, line 3, through page 7, line 2. 

Lauer is directed to a signaling network management system for converting network events 
into standard form and then correlating the standard form events with topology and maintenance 
information. The alleged APA on page 2 of Applicants' specification refers to mutually exclusive 
data viewing approaches, i.e., viewing raw data, viewing summary information, and viewing 
graphical displays. 

First, Applicants assert that no motivation or suggestion exists to combine Lauer and the 
alleged APA. For at least this reason, a prima facie case of obviousness has not been established. 
Motivation to combine cannot come from the Applicants' own specification. This is impermissible 
hindsight. In fact, Applicants' specification points out the very deficiencies from which an approach 
such as that taught by Lauer suffers. 

Applicants specification at page 2, line 18, through page 4, line 7 (the source of the alleged 
APA) describes three different, but mutually exclusive , ways to analyze event logs, i.e, viewing raw 
data, viewing summary information, and viewing graphical displays. As pointed out, each of them 
has its own advantages. Directly reading the textual messages provides the most detailed 
information of event messages. The aggregated event analysis provides a nice scaling property and 
shows summarization. The event plot can reveal event patterns and relationship among events. 
Most available products for analyzing a log file specialize on one type of log file. Unfortunately, 
all of these special log analyzers only support summarization analysis. None of them can be used 
to visualize event messages and/or see original messages. On the other hand, there are many general 
graphical tools. These tools aim to support either graphical analysis of numerical data or aggregated 
level summarization. However, none of them provide both types of analysis. In addition, these tools 
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usually only take structured data as inputs and can not handle textual data directly. 

Therefore, as the specification explains, it would be highly desirable to provide systems and 
methods which integrate different analysis approaches, thus providing a user with the capability and 
flexibility to perform multiple types of analysis on raw data for event management purposes. This 
is what the claimed invention is directed toward. 

Despite the Examiner's contention, there is nothing in Lauer that would suggest motivation 
to yield the integrated presentation and analysis approach of the claimed invention. Further, since 
the approaches described in the specification are generally mutually exclusive, there is no known 
motivation to combine any of them into a single presentation and analysis technique, as in the 
claimed invention. 

Second, Applicants assert that there is no reasonable expectation of success in achieving the 
present invention through a combination of Lauer and the alleged APA. For at least this reason, a 
prima facie case of obviousness has not been established. As mentioned above, despite the assertion 
in the outstanding final Office Action, Applicant does not believe that Lauer and the alleged APA 
are combinable since it is not clear how one would combine them given that the various approaches 
are mutually exclusive. There are no teachings in the cited combination as to how to coordinate data 
associated with two or more of the presentations, when desired, to enable a coordinated analysis of 
the data, as in the claimed invention. 

Lastly, Applicants assert that the combination of Lauer and the alleged APA fails to teach 
or suggest all of the claim limitations of independent claims 1,9,12 and 20. For at least this reason, 
a prima facie case of obviousness has not been established. Again, assuming arguendo that Lauer 
and the alleged APA could be properly combined, which for at least the reasons above it is believed 
that they can not be properly combined, the combination fails to teach or suggest all claim elements 
in independent claims 1,9, 12 and 20. 

By way of example, the inventions of claims 1, 9, 12 and 20 recite "coordinating data 
associated with two or more of the presentations, when desired, to enable a coordinated analysis of 
the data." This is explained, for example, at page 6 of the specification where it states that the 
invention not only preferably provides multiple viewers, but also combines and coordinates these 
viewers for analyzing events. For example, a user can very easily select a set of interesting events 
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for a set of hosts and event types from the attribute viewer (e.g., summary viewing) by highlighting 
these hosts and event types, then use the plot viewer (e.g., graphical viewing) to see the relationship 
among the selected events. From the plot viewer, he can further select a small set of suspicious 
events by dragging a rubber-band, and displaying the original textual messages related to the selected 
events in the message viewer (e.g., raw data viewing). Further, by highlighting, coloring, or 
otherwise selecting events in one viewer, he can cause to have similarly modified presentations of 
these events in other viewers. 

Assuming arguendo that it is proper to combine Lauer and the alleged APA to yield a group 
of presentation techniques, the cited combination is silent as to "coordinating data associated with 
two or more of the presentations, when desired, to enable a coordinated analysis of the data." 

Also, Applicants point out that the portion of Lauer cited in the Office Action in rejecting 
the "providing presentation operations" claim language has nothing to do with presentation 
operations. The Office Action cites element 7 1 4 of FIG. 7a of Lauer as having something to do with 
presentation operations, however, such an element is related to some memory loading operation, see 
column 12, lines 1-3 of Lauer. 

Rabenhorst fails to remedy the above deficiencies since it is directed toward a graphical 
visualization approach. FIG. 3 of Rabenhorst, cited by the Examiner, is a graphical visualization 
known as a scatter plot. Even in a proper combination with Lauer and the alleged APA, all of the 
elements of the claimed invention are still not taught or suggested. 

For at least the above reasons, Applicants respectfully request withdrawal of the §103 
rejections of independent claims 1, 9, 12 and 20. 

The remainder of the claims rej ected over the Lauer-alleged APA combination depend, either 
directly or indirectly, from claims 1, 9 or 12, which are believed patentable for the reasons set forth 
above. Furthermore, the remaining claims define additional patentable subject matter in their own 
right. By way of example only, claims 3 and 14 recite the step/operation of modifying one or more 
parsing rules to affect the parsing operation. The portion of Lauer cited to support this rejection (i.e., 
column 14, lines 50-52) deals with modifying a presentation, not modifying parsing rules. 
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For at least the above reasons, Applicants respectfully request withdrawal of the §103 
rejections of dependent claims 3-8, 10, 11 and 14-19. 

Regarding the rejection of claims 2 and 13 under 103(a) based on Lauer, the alleged APA 
and Rabenhorst, Applicants respectfully reiterate the arguments presented above regarding the 
impropriety of the Lauer-alleged APA combination, and respectfully assert that such arguments 
apply with equal force to the Lauer-alleged APA-Rabenhorst combination used in rejecting the 
indicated claims. Accordingly, Applicants respectfully assert that the indicated claims are patentable 
by virtue of their dependency from claims 1 and 12, and because they define additional patentable 
subject matter in their own right. 

For at least the above reasons, Applicants respectfully request withdrawal of the §103 
rejections of dependent claims 2 and 13. 

Accordingly, for at least the foregoing reasons, claims 1 -20 are believed to be patentable over 
the cited references. As such, the application is asserted to be in condition for allowance, and 
favorable action is respectfully solicited. 

Attached hereto is a marked-up version of the changes made to the specification and claims 
by the present Amendment. 



Respectfully submitted, 
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William E. Lewis ( 
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Ryan, Mason & Lewis, LLP 
90 Forest Avenue 
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VERSION WITH MARKINGS TO SHOW CHANGES MADE 

IN THE SPECIFICATION 

The paragraph beginning at page 19, line 13, has been amended as follows: 
Although illustrative embodiments of the present invention have been described herein with 
reference to the accompanying drawings, it is to be understood that the invention is not limited to 
those precise embodiments, and that various other changes and modifications may be [affected 
therein] made by one skilled in the art without departing from the scope or spirit of the invention. 

IN THE CLAIMS 

Claims 1, 9, 12 and 20 have been amended as follows: 

1 . (Amended) A processor-based method for use in analyzing non-fully structured data 
which is associated with one or more events, the method comprising the steps of: 

parsing at least a portion of the non- fully structured data according to one or more parsing 
rules to convert the at least a portion of non- fully structured data' to structured data; [and] 

providing presentation operations which [include presenting] are respectively able to provide 
a presentation of at least a portion of the non-fully structured data A [and at least one of: (i)] 
format[ting] at least a portion of the structured data to provide a presentation of a graphical 
representation of the at least a portion of structured data, and [(ii)] formatting] at least a portion of 
the structured data to provide a presentation of a summary representation of the at least a portion of 
structured dat a: and 

coordinating data associated with two or more of the presentations, when desired, to enable 
a coordinated analysis of the data . 

9. (Amended) A system for use in analyzing non-fully structured data which is associated 
with one or more events, the system comprising: 

a parsing engine which parses at least a portion of the non-fully structured data according to 
one or more parsing rules to convert the at least a portion of non-fully structured data to structured 
data; 

viewers which are respectively able to provide a presentation of [present] at least a portion 
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of the non-fiilly structured data A [and perform at least one of: (i)] formatting] at least a portion of 
the structured data to provide a presentation of a graphical representation of the at least a portion of 
structured data, and [(ii)] formatting] at least a portion of the structured data to provide a 
presentation of a summary representation of the at least a portion of structured data . wherein data 
associated with two or more of the presentations is coordinated, when desired, to enable a 
coordinated analysis of the data : and 

a selection and control engine coupled to the parsing engine and the viewers which controls 
operations associated with the parsing engine and the viewers. 

1 2. (Amended) Apparatus for use in analyzing non- fully structured data which is associated 
with one or more events, the apparatus comprising: 

at least one processor operable to: (i) parse at least a portion of the non-fiilly structured data 
according to one or more parsing rules to convert the at least a portion of non-fiilly structured data 
to structured data[, and operable to] : (ii) provide presentation operations which [include presenting] 
are respectively able to provide a presentation of at least a portion of the non-fully structured data a 
[and at least one of: (i)] formatting] at least a portion of the structured data to provide a presentation 
of a graphical representation of the at least a portion of structured data, and [(ii)] formatting] at least 
a portion of the structured data to provide a presentation of a summary representation of the at least 
a portion of structured dat a: and (Hi) coordinate data associated with two or more of the 
presentations, when desired, to enable a coordinated analysis of the data : and 

memory coupled to the at least one processor for storing at least one of the non-fiilly 
structured data, the structured data and the one or more parsing rules. 

20. (Amended) An article of manufacture for use in analyzing non-fixlly structured data 
which is associated with one or more events, comprising a machine readable medium containing one 
or more programs which when executed implement the steps of: 

parsing at least a portion of the non-fiilly structured data according to one or more parsing 
rules to convert the at least a portion of non-fiilly structured data to structured data; [and] 

providing presentation operations which [include presenting] are respecti vely able to provide 
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a presentation of at least a portion of the non-fully structured data a [and at least one of: (i)] 
format[ting] at least a portion of the structured data to provide a presentation of a graphical 
representation of the at least a portion of structured data, and [(h)] formatting] at least a portion of 
the structured data to provide a presentation of a summary representation of the at least a portion of 
structured dat a; and 

coordinating data associated with two or more of the presentations, when desired, to enable 
a coordinated analysis of the data . 



